Description
The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wpopal | Opal Estate | ≤ 1.6.11 | — |